DeadLock Malware Exploits Polygon Good Contracts to Cover

A recently-discovered ransomware dubbed “DeadLock” is stealthily exploiting Polygon good contracts to rotate and distribute proxy addresses, say researchers at cybersecurity agency Group-IB.

The corporate reported on Thursday that the DeadLock ransomware, first found in July, has seen “low publicity” because it isn’t tied to any identified knowledge leak web site or affiliate applications and has a “restricted variety of reported victims.”

Nevertheless, Group-IB warned that although the ransomware is “low profile,” it makes use of “progressive strategies” that may very well be harmful to organizations that don’t take the malware severely, “particularly for the reason that abuse of this particular blockchain for malicious functions has not been broadly reported.”

DeadLock leverages Polygon good contracts to retailer and rotate proxy server addresses used to speak with victims. Code embedded within the ransomware interacts with a selected good contract handle and makes use of a perform to dynamically replace command-and-control infrastructure.

As soon as victims have been contaminated with the malware and encryption has occurred, DeadLock threatens them with a ransom word and the promoting of stolen knowledge if their calls for aren’t met.

Infinite variants of the method might be utilized

By storing proxy addresses on-chain, Group-IB mentioned DeadLock creates infrastructure that’s extraordinarily troublesome to disrupt, as there is no such thing as a central server to take down, and blockchain knowledge persists indefinitely throughout distributed nodes worldwide.

Associated: Hackers discover new option to cover malware in Ethereum good contracts

“This exploit of good contracts to ship proxy addresses is an attention-grabbing technique the place attackers can actually apply infinite variants of this method; creativeness is the restrict,” it added.

North Korean risk actors discovered “EtherHiding” 

Weaponizing good contracts for malware dissemination will not be new, with Group-IB noting a tactic known as “EtherHiding” that Google reported in October.